Search code examples
dockeramazon-ecr

Docker tagging without 'latest' tag?


We've been discussing tagging strategies for our docker ECR repos and what we've landed on doesn't involve use of the latest tag at all.

I know latest isn't anything automatic. It's just a regular tag. But it's also a convention. Is it expected that latest exists? Are there tooling problems or things that may break if our repos don't have it at all?


Solution

  • You should be fine without the latest tag - there should be no tooling problems as long as you are using other tags and / or sha256 digests explicitly for pulling images.

    That said, usually there is no good reason to avoid latest tag completely. Conventional approach is to push your latest acceptable build to its own tag AND the latest tag. It is hard to find an argument against this approach, since using latest is convenient in many non-scripted cases (i.e., a developer pulling the image locally and just using latest) - and at the same time you get this image with its proper tag.

    Final thing I want to mention - since tags may be mutable, scripted pipelines and especially production instances should use explicit sha256 digests when pulling images.